Wyoming Medical Records Retention Laws (2026 Guide)

---

title: "Wyoming Medical Records Retention Laws" meta_description: "Wyoming has no state medical records retention law after repealing its Hospital Records Act in 2019. Learn what federal rules apply and how long providers should keep records."

Overview of Wyoming Medical Records Retention Laws

Wyoming stands alone among American states in having no active state law that requires healthcare providers to retain medical records for a specific period of time. In 2019, Wyoming repealed its entire Hospital Records Act, the set of statutes (Wyo. Stat. Ann. 35-2-605 through 35-2-617) that previously governed hospital record confidentiality, disclosure, and retention. That repeal, enacted through Senate File 96 (SF0096) and signed into law as Laws 2019, Chapter 78, Section 3, took effect on July 1, 2019.

Before the repeal, Wyoming hospitals operated under Wyo. Stat. Ann. 35-2-606, which required them to keep patient records for just three years. That was the shortest state-mandated retention period in the entire United States. Most states require between 5 and 10 years of retention, and several states mandate even longer periods for certain categories of patients.

Today, Wyoming healthcare providers must look to federal law, professional licensing board rules, and industry best practices to determine how long they should retain patient medical records.

The 2019 Repeal: Why Wyoming Eliminated Its Hospital Records Act

Wyoming's Hospital Records Act was originally enacted in 1991 to protect the privacy of patient information held by hospitals. At the time, no comprehensive federal health privacy law existed. The act established requirements for hospital disclosures of patient data, patient authorization rules, retention standards, and security safeguards.

Five years after Wyoming passed its Hospital Records Act, Congress enacted the Health Insurance Portability and Accountability Act (HIPAA) of 1996. HIPAA and its implementing Privacy Rule and Security Rule created a comprehensive federal framework for protecting patient health information. Over time, Wyoming lawmakers and healthcare organizations recognized that the state Hospital Records Act had become redundant.

According to Wyoming Hospital Association President Eric Boley, the state law "did a really good job" but created compliance complications because hospitals had to follow both the state act and HIPAA, while physician clinics only had to follow HIPAA. As Boley explained, "If a patient was seen in a hospital, it fell under the Hospital Records Act, but if a patient was seen in a physician's clinic, it fell under HIPAA."

Senators Dave Kinskey (R-Sheridan), Representative Mark Kinner (R-Sheridan), and Representative Cyrus Western (R-Big Horn) sponsored SF0096 to resolve this inconsistency. The bill passed both chambers of the Wyoming Legislature and took effect July 1, 2019, repealing all of Article 6 of Title 35, Chapter 2.

The repeal did not reduce patient privacy protections. Instead, it aligned Wyoming with the federal HIPAA framework, creating a single, uniform standard for all healthcare providers in the state regardless of practice setting.

Hospital Records Retention in Wyoming

Because Wyoming no longer has a state statute governing hospital record retention, hospitals in Wyoming must follow federal requirements. The most important federal rule comes from the Centers for Medicare and Medicaid Services (CMS).

Medicare Conditions of Participation

Under 42 CFR 482.24, hospitals that participate in Medicare must maintain a medical record for every individual evaluated or treated in the hospital. The regulation states that medical records must be "accurately written, promptly completed, properly filed and retained, and accessible."

Most significantly, 42 CFR 482.24(b) requires that medical records be "retained in their original or legally reproduced form for a period of at least 5 years." Since virtually all hospitals in Wyoming participate in Medicare, this 5-year federal minimum is the effective floor for hospital record retention in the state.

Hospitals must also maintain a coding and indexing system that allows timely retrieval of records by diagnosis and procedure. The regulation requires hospitals to ensure the confidentiality of patient records and to release information only to authorized individuals.

Practical Implications for Wyoming Hospitals

Even though the old state law only required 3 years, the federal Medicare requirement of 5 years has long been the practical minimum for Wyoming hospitals. Many hospital systems voluntarily retain records for 10 years or longer based on risk management advice and industry best practices recommended by the American Health Information Management Association (AHIMA).

Physician and Private Practice Records

Wyoming has never had a state statute that specifically mandates how long physicians in private practice must retain patient medical records. Neither the repealed Hospital Records Act nor any current state law addresses this gap directly.

Wyoming Board of Medicine Rules

The Wyoming Board of Medicine does regulate physician conduct regarding medical records through its administrative rules. Under 052-3 Wyo. Code R. Section 3-4, physicians have several obligations related to patient medical records.

Physicians must respond to a patient's written request for medical records "within a reasonable period or no more than thirty days, whichever is shorter." This rule applies to all licensed physicians in the state.

The rule clarifies that ownership of the physical record belongs to the physician or health care facility. Patients have a right to access their information but not to possess the physical storage medium (paper chart, microfilm, or data storage unit).

Physicians may provide either an "accurate, detailed, comprehensive summary" or actual copies of the medical record, including x-rays and diagnostic records when requested. A physician may charge the patient for actual costs incurred in responding to a records request but cannot deny access based on inability to pay.

Violations of these medical records access rules constitute grounds for disciplinary action under Wyo. Stat. Ann. 33-26-402(a)(xxxi).

Recommended Retention for Physicians

Without a state-mandated retention period, Wyoming physicians should consider several factors when setting their own retention policies:

• Statute of limitations for medical malpractice: Wyoming's medical malpractice statute of limitations under Wyo. Stat. Ann. 1-3-107 is 2 years from the date of the alleged act. However, tolling provisions and discovery rules can extend this period.
• Contract claims: Wyo. Stat. Ann. 1-3-105(a) allows 10 years for written contract claims and 8 years for oral contracts.
• AHIMA recommendation: The American Health Information Management Association recommends retaining adult patient records for a minimum of 10 years from the date of the last encounter.

Most legal experts advise Wyoming physicians to retain records for at least 10 years to protect against potential malpractice claims and contract disputes.

Minor Patient Records in Wyoming

Wyoming does not have a specific statute addressing the retention of medical records for minor patients. However, several legal principles extend the effective retention period for minors well beyond what applies to adults.

Statute of Limitations for Minors

Under Wyoming law, the statute of limitations for medical malpractice involving a minor does not begin to run until the child reaches the age of majority (18 years old). Under Wyo. Stat. Ann. 1-3-107, a cause of action for injury to a minor must be brought by the child's eighth birthday or within two years of the alleged act, whichever period is greater.

The Wyoming Supreme Court further strengthened protections for minors in the 2014 case Kordus v. Montes, holding that applying the standard two-year statute of limitations to minor medical malpractice claims violates the Wyoming Constitution.

Recommended Retention Period for Minors

Given these legal realities, healthcare providers in Wyoming should retain medical records for minor patients until the child reaches age 18 plus an additional period sufficient to cover the applicable statute of limitations. Most experts recommend retaining minor patient records until the patient turns at least 21 to 25 years old, depending on the specific circumstances.

For providers who treat newborns or very young children, this could mean retaining records for two decades or more.

HIPAA Requirements in Wyoming

Since Wyoming now relies entirely on federal law for health information privacy, HIPAA plays a central role in how providers manage medical records in the state.

What HIPAA Does and Does Not Require

A common misconception is that HIPAA mandates a specific retention period for patient medical records. According to the U.S. Department of Health and Human Services (HHS), HIPAA does not include medical record retention requirements. Instead, HIPAA defers to state laws for determining how long medical records must be kept.

What HIPAA does require is that covered entities retain HIPAA-related documentation for six years. Under 45 CFR 164.530(j), this includes privacy policies and procedures, privacy practices notices, disposition of complaints, and other actions, activities, and designations that the Privacy Rule requires to be documented. This six-year requirement applies to compliance documentation, not to patient medical records themselves.

HIPAA Privacy Rule Protections

Under HIPAA, Wyoming patients have the right to access their protected health information (PHI), request amendments to their records, receive an accounting of disclosures, and request restrictions on certain uses of their information. These rights apply regardless of provider type or practice setting.

HIPAA Security Rule Requirements

The HIPAA Security Rule requires covered entities to implement administrative, physical, and technical safeguards to protect electronic protected health information (ePHI). This applies to all electronic medical records maintained by Wyoming providers, whether hospitals, clinics, or private practices.

CMS and Medicare Requirements

Beyond the hospital-specific requirements in 42 CFR 482.24, CMS imposes additional record retention obligations on various provider types.

Medicare Billing Records

Healthcare providers who bill Medicare must maintain sufficient documentation to support the medical necessity and appropriateness of the services billed. CMS requires providers to retain these records for a minimum of 5 years from the date of service or, for Medicare managed care organizations, for 10 years.

Critical Access Hospitals

Wyoming has several Critical Access Hospitals (CAHs) in its rural communities. Under 42 CFR 485.638, CAHs must maintain clinical records for each patient, and these records must be retained for at least 6 years from the date of the last entry or, in the case of a minor, 3 years after the patient reaches age 18, whichever is longer.

Skilled Nursing Facilities

Under 42 CFR 483.70, skilled nursing facilities must retain clinical records for at least 3 years after the discharge of the resident, with longer periods required if mandated by state law.

Medical Records Destruction in Wyoming

When the applicable retention period expires, Wyoming providers must follow specific procedures for destroying medical records to remain compliant with federal law.

HIPAA Destruction Standards

HIPAA requires covered entities to implement appropriate administrative, physical, and technical safeguards when disposing of protected health information. According to HHS guidance on the disposal of PHI, acceptable methods include:

• Paper records: Shredding, burning, pulping, or pulverizing so that PHI is rendered "essentially unreadable, indecipherable, and otherwise cannot be reconstructed"
• Electronic records: Clearing (overwriting), purging (degaussing or using cryptographic erase), or physically destroying the media through disintegration, pulverization, melting, incinerating, or shredding

Providers must never dispose of PHI in dumpsters, recycling bins, or other receptacles accessible to the public or unauthorized persons.

Business Associate Requirements

Wyoming providers who use outside vendors to assist with record storage or destruction must have a HIPAA-compliant Business Associate Agreement (BAA) in place. The BAA must specify the vendor's obligations regarding the handling, storage, and destruction of protected health information.

Documentation of Destruction

Providers should maintain a destruction log documenting what records were destroyed, the date of destruction, the method used, and the name of the person or entity that performed the destruction. This documentation should be retained for at least six years as part of the provider's HIPAA compliance records.

Practice Closure and Records Transfer

Wyoming has limited state-level requirements for what happens to medical records when a practice closes.

Physician Notification Obligations

Under Wyoming Board of Medicine rules, physicians may (but are not required to) place a sign in a conspicuous location at their office or send letters to patients notifying them of the termination, sale, or relocation of the practice. The notice should advise patients of their opportunity and right to transfer or receive copies of their records.

Although Wyoming law makes notification optional rather than mandatory, failing to make reasonable efforts to notify patients could expose a physician to disciplinary action or malpractice claims.

Best Practices for Practice Closure

Healthcare providers closing a practice in Wyoming should take the following steps:

• Provide written notice to all active patients at least 30 days before closure
• Publish a notice in local newspapers
• Notify the Wyoming Board of Medicine
• Arrange for a custodian to maintain records for the applicable retention period
• Ensure the custodian has a HIPAA-compliant Business Associate Agreement
• Transfer records to the custodian using secure, HIPAA-compliant methods

Professional medical records custodian services are available to handle long-term storage and patient access requests after a practice closes.

Why Wyoming Has the Shortest Requirements

Wyoming's position as the state with the least restrictive medical records retention requirements is the result of several converging factors.

Historical Context

Wyoming's original Hospital Records Act of 1991 set only a 3-year retention requirement for hospitals, which was already the shortest in the nation at that time. The state's small population (approximately 577,000 as of 2024, making it the least populous U.S. state), limited number of healthcare facilities, and traditionally minimal regulatory approach all contributed to this brief retention period.

Regulatory Philosophy

Wyoming has long embraced a philosophy of limited government regulation. The state has no state income tax and consistently ranks among the states with the fewest business regulations. This approach extends to healthcare regulation, where the state has historically deferred to federal standards rather than creating additional state-level requirements.

The 2019 Repeal

When Wyoming repealed its Hospital Records Act in 2019, it did not replace the retention provisions with new state requirements. Instead, the legislature determined that HIPAA and federal CMS regulations provided sufficient protection and that maintaining a separate, potentially conflicting state framework created more problems than it solved.

Practical Impact

The practical impact of Wyoming's minimal state requirements is limited because federal rules, professional standards, and malpractice risk management considerations effectively require providers to retain records far longer than the old 3-year state minimum. Most Wyoming providers retain records for at least 7 to 10 years as a matter of standard practice.

Summary of Retention Requirements for Wyoming Providers

The following table summarizes the retention periods that apply to different types of Wyoming healthcare providers:

Provider Type	Applicable Rule	Minimum Retention Period
Medicare-participating hospitals	42 CFR 482.24	5 years
Critical Access Hospitals	42 CFR 485.638	6 years (or age 18 + 3 years for minors)
Skilled Nursing Facilities	42 CFR 483.70	3 years after discharge
Private physicians	No state law; federal and professional guidelines	10 years recommended
HIPAA compliance documentation	45 CFR 164.530(j)	6 years
Minor patient records	Statute of limitations considerations	Until age 21-25 recommended